Assad\'s Anonymous Cyber-Force: Who is the Syrian Electronic Army?

We profile the pro-Assad Syrian Electronic Army which is waging cyber war against media outlets it believes are spreading lies about the war in Syria.

Logo of the Syrian Electronic Army

The Syrian Electronic Army is representative of a much wider move online in modern warfare. While we are yet to truly see a full-scale cyber-war, almost every single conflict taking place around the globe is being fought in some part in cyber-space.

While covert government surveillance has been going on for decades, we saw the first real signs of overt cyber-warfare in the Arab Spring uprisings over the last three years. Rebel forces who saw access to the internet taken away from them by government forces turned to the hacktivist collective known as Anonymous to get their messages out to the wider world - and to devestating effect for the respective governments.

Those governments of Tunisia, Egypt and Libya were left flat-footed, powerless to do anything about what was happening.

The same cannot be said for the regime of President Bashar al-Assad who saw what was happening and did something about it.

How and when was SEA formed?

Numerous videos have appeared on YouTube over the last two years, claiming to show gruesome atrocities carried out by government forces as well as many anti-Assad protests.

In response, Assad put in place a covert group of hackers - which became known as the Syrian Electronic Army (SEA) - charged with fighting back against rebel forces who had begun to use social media to raise support for their cause.

During a speech at Damascus university in 2011, Assad said:

"The army consists of the brothers of every Syrian citizen ... Young people have an important role to play at this stage, because they have proven themselves to be an active power. There is the electronic army, which has been a real army in virtual reality."

The group seems to have emerged from a group known as the Syrian Computer Society, which Assad was at one time the head of.

When did they begin attacking media outlets?

The group's first attack came in 26 September of that year, against the Harvard University website, with the defaced domain showing a picture of Assad featured the message: ""SyRiAn ELeCTronic ArMy WeRe HeRE" - which has become a calling card for the group since.

In 2012, before the civil unrest in Syria really came to attention of the western media, the SEA remained relatively low key, launching just a few attacks on targets like LinkedIn and Al Jazeera.

However from the beginning of February of this year the group became increasingly active launching attacks on high profile targets such as the Sky News, the Financial Times, the Guardian, the BBC and culminating with a hack of the AP Twitter feed which saw $140 billion wiped off the S&P 500 index for a brief period.

How has it been so successful?

The primary method employed by the group is phishing. This involves sending targeted emails to employees of the media outlets the SEA are targeting. If just one employee clicks on a malicious link in the email, or downloads a malicious attachment, malware can be installed on the PC and could give SEA members access to the entire system, or at the very least passwords for Twitter, Facebook and other social media accounts.

If media outlets have not trained all staff on the dangers of phishing then it is relatively easy to get access to systems and networks for hackers once they have some basic information like email addresses and names of some key employees.

Who supports the SEA?

While the SEA itself says it operates independent of the Assad regime, it is widely believed that the President is supporting the operation.

If defectors are to be believed and the outfit has shifted operations to Dubai, it is thought that the Assad's billionaire cousin Rami Makhlouf is now bankrolling and the group is now operating out of one of his shadowy Dubai-based companies.

Why do they attack western media outlets?

On the group's official website (which has recently been taken offline by the group's hosting service) the SEA said they "could not stay passive towards the massive distortion of facts about the recent uprising in Syria."

They believe that many Arab and western media outlets are helping the rebels to spread lies about what is really happening in Syria, with the recent issue over the use of chemical weapons possibly the most high profile case of all.

How many members does it have?

This is a tough question to get an accurate answer to. In a recent interview with Mashable, a person claiming to be from the SEA said:

"We have tens of thousands of members that have different roles according to their abilities with more people joining every day or volunteering. We have a special operations division that you are probably asking about and we have more than ten specialists."

Beyond saying there are "more than ten" members of the SEA, it is hard to put an exact figure on it.

Where are they based?

Again a tough question to answer accurately as various reports put the members of the group in Syria, Dubai, Turkey and even Iran.

In an interview with ABC News last week, a person claiming to be a member of the SEA called The Shadow said "most" SEA members were operating from within Syria. However in an interview with Mashable this week, another person claiming to be a representative of the SEA said:

"We are all based in Syria."

According to defectors from within the group speaking to the Guardian in April - soon after the newspaper Twitter accounts had been hacked - the SEA was originally based in Damascus but was moved in 2012 to a secret base in Dubai.

Further indications of the SEA locations came from security researcher Brian Krebs last week who claimed that one of the core architects of the group is currently in Turkey.